syslog not getting logs from 6509

[amit bhatnagar]

Hello , I have configured my 6509 to send logs to syslog server but we dont see any logs coming from it , we are reciving logs on syslog from other network devices but not from this switch below is config if anyone can advise 

logging console informational

logging event link-status default

logging source-interface Vlan231 vrf VRF_INFRA

logging host 10.7.2.1 transport udp port 1514

[cadet alain]

Hi,

I see you are sourcing syslog messages from a VRF.

Can you post sh ip route vrf *

Regards

Alain

Don't forget to rate helpful posts.

[amit bhatnagar]

Hello Cadet  ,

Thanks for reply please find output below .

sh ip route vrf VRF_INFRA

O*E2  0.0.0.0/0 [110/1] via 10.7.0.249, 1w0d, Vlan989

      10.0.0.0/8 is variably subnetted, 52 subnets, 6 masks

B        10.6.0.0/29 [200/0] via 207.82.70.210, 6w1d

B        10.6.0.16/29 [200/0] via 207.82.70.210, 6w1d

B        10.6.0.80/28 [200/0] via 207.82.70.210, 6w1d

B        10.6.0.248/29 [200/0] via 207.82.70.210, 6w1d

B        10.6.230.0/24 [200/0] via 207.82.70.210, 6w1d

B        10.6.231.0/24 [200/0] via 207.82.70.210, 6w1d

B        10.6.232.0/24 [200/0] via 207.82.70.210, 6w1d

B        10.6.233.0/24 [200/0] via 207.82.70.210, 6w1d

B        10.6.234.0/24 [200/0] via 207.82.70.210, 6w1d

B        10.6.240.0/22 [200/0] via 207.82.70.210, 6w1d

B        10.6.250.0/24 [200/0] via 207.82.70.210, 6w1d

B        10.6.251.0/24 [200/0] via 207.82.70.210, 6w1d

B        10.6.252.0/24 [200/0] via 207.82.70.210, 6w1d

B        10.6.253.0/24 [200/0] via 207.82.70.210, 6w1d

B        10.6.254.0/24 [200/0] via 207.82.70.210, 6w1d

C        10.7.0.0/29 is directly connected, Vlan990

L        10.7.0.6/32 is directly connected, Vlan990

C        10.7.0.16/29 is directly connected, Vlan992

L        10.7.0.22/32 is directly connected, Vlan992

O        10.7.0.72/29 [110/11] via 10.7.0.249, 1w0d, Vlan989

C        10.7.0.80/28 is directly connected, Vlan994

L        10.7.0.94/32 is directly connected, Vlan994

O        10.7.0.112/29 [110/11] via 10.7.0.249, 1w0d, Vlan989

O        10.7.0.136/29 [110/11] via 10.7.0.249, 1w0d, Vlan989

O        10.7.0.144/29 [110/11] via 10.7.0.249, 1w0d, Vlan989

O        10.7.0.200/29 [110/11] via 10.7.0.249, 1w0d, Vlan989

C        10.7.0.248/29 is directly connected, Vlan989

L        10.7.0.254/32 is directly connected, Vlan989

O        10.7.123.0/24 [110/11] via 10.7.0.249, 1w0d, Vlan989

O        10.7.200.0/27 [110/11] via 10.7.0.249, 1w0d, Vlan989

C        10.7.230.0/24 is directly connected, Vlan230

L        10.7.230.254/32 is directly connected, Vlan230

C        10.7.231.0/24 is directly connected, Vlan231

L        10.7.231.254/32 is directly connected, Vlan231

C        10.7.232.0/24 is directly connected, Vlan232

L        10.7.232.254/32 is directly connected, Vlan232

C        10.7.233.0/24 is directly connected, Vlan233

L        10.7.233.254/32 is directly connected, Vlan233

C        10.7.234.0/24 is directly connected, Vlan234

L        10.7.234.254/32 is directly connected, Vlan234

C        10.7.240.0/22 is directly connected, Vlan240

L        10.7.243.254/32 is directly connected, Vlan240

C        10.7.250.0/24 is directly connected, Vlan250

L        10.7.250.254/32 is directly connected, Vlan250

C        10.7.251.0/24 is directly connected, Vlan251

L        10.7.251.254/32 is directly connected, Vlan251

C        10.7.252.0/24 is directly connected, Vlan252

L        10.7.252.254/32 is directly connected, Vlan252

C        10.7.253.0/24 is directly connected, Vlan253

L        10.7.253.254/32 is directly connected, Vlan253

C        10.7.254.0/24 is directly connected, Vlan254

L        10.7.254.254/32 is directly connected, Vlan254

[cadet alain]

What is the output from   ping  vrf  VRF_INFRA 10.7.2.1 so Vlan231 ?

Regards

Alain

Don't forget to rate helpful posts.

[amit bhatnagar]

Below is output of ping 10.7.231.1 ,apology in first post i have mentioned 10.7.2.1 its typo mistake correct ip is 10.7.231.1

#ping  vrf  VRF_INFRA 10.7.231.1 so Vlan231

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.7.231.1, timeout is 2 seconds:

Packet sent with a source address of 10.7.231.254

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms

[cadet alain]

Hi,

logging host 10.7.2.1 transport udp port 1514    the default port is 514, is this a typo ?

Regards

Alain

Don't forget to rate helpful posts.

[amit bhatnagar]

hello Alain ,

1514 is correct port its the one on which syslog is listening , and other devices are getting logged .

Regards

Amit

[Jon Marshall · Accepted solution]

Amit

Can you try and add the VRF to the logging host line eg.

logging host 10.7.2.1 vrf VRF_INFRA ....

Jon

[cadet alain]

Hi jon,

Good catch I think  , can we still use the source-interface command in this case ?

Regards

Alain

Don't forget to rate helpful posts.

[Jon Marshall]

Hi Alain

can we still use the source-interface command in this case ?

As far as i know yes you can because you still may want to specificy which IP the syslog messages are seen from.

Jon

[cadet alain]

Hi Jon,

I ask this because there is this output here:

http://www.cisco.com/en/US/docs/ios/12_2sr/12_2sra/feature/guide/srvrfslg.html

"You cannot specify a source address for VRF system  logging messages. The VRF Aware System Message Logging feature uses the  VRF interface address as the source address for all VRF-aware system  logging messages. "

My question is is it still mandatory here if you enable vrf aware logging or will it impact the behaviour of logging or will it simply be ignored ?

Regards

Alain

Don't forget to rate helpful posts.

[Jon Marshall]

Alain

Ahh, so it was a trick question

Seriously though to be completely honest i am not sure. The document does seem to suggest you cannot use both although this is for 12.2SR which is not used on 6500s so it may be slightly different behaviour on the 6500.

Jon

[cadet alain]

Jon,

No trick question , just wanted to have your opinion as you are far more experienced than I am 

To be honest I didn't look for other IOS code and other platforms and maybe I should have  before asking 

Regards

Alain

Don't forget to rate helpful posts.

[Jon Marshall]

Alain

No problem, it was only said in jest

The problem with documentation is that sometimes not all docs are updated so you end up referring to one IOS release and you have to assume it applies to other releases that support the same feature.

So i would just assume you can't use it but would try testing it anyway to see what happens.

Jon

[cadet alain]

Jon,

no worry I understood it was a jest

Thanks for your replies.

Regards.

Alain

Don't forget to rate helpful posts.